211–220 of 526 posts
Looks like they require Google Authenticator or Duo Mobile app to do two-factor auth. I'm not interested. Why can't they be like Github and just send me a text message? I don't want a dependency on some other company's product to make Slack more secure.
Its like 'but it says AES on the box so its secure right?' and shouldn't be a thing among developers anymore.
Obviously the database data has to be decrypted for the app to use it, and generally, you hack the app, not the db.
I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…
Earlier quoted context omitted.
Agree with you in one sense of being responsible for your own security, but by this logic I should keep all my money under the mattress instead of the bank, no?
Not the same thing. Banks are insured against robbery and theft, so if something like that happens, customers don't lose their money. In addition, there's an insane amount of fraud protection in the banking industry, and billions of dollars of vested interests to make sure criminals are caught and prosecuted. Can you say the same about cloud services?
Earlier quoted context omitted.
You append the salt to the hash, and then re-hash it. Not exactly pretty, but it works.
His example doesn't rehash. His example adds the pepper to the initial salt. This is an honest question, how does one apply it retroactively?
Earlier quoted context omitted.
Third party authentication should be the norm. Leaving authentication to providers that absolutely know their shit , just like we leave payments to third party services. Of course, that requires a decent protocol, and Mozilla is doing the world a disservice in not marketing Persona better seeing as it's the right solution....
Major privacy issues, single point of failure etc etc. We leave payments to third party services because nobody wants to deal with the compliance nightmare that PCI-DSS is, not for security reasons. Payment is also mostly less sensitive to availability and latency issues than authentication.
Why's a password so different, seeing as most people reuse those passwords? Why do we essentially allow (and yes, I am excluding those that use password managers in this statement, I'm one of those) access to our webmail and other critical services to random websites on the internet? What makes this right?
> Payment is also mostly less sensitive to availability and latency issues than authentication.
That's patently untrue. Latency issues are nonexistant in both areas, and availability issues are critical in both areas.
I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…
I generally disagree with hardcoded salts, you should assume everything is compromised in a successful attack. But I'm actually commenting here because I don't see how you can retroactively apply the second salt to a hashed string. Could you please elaborate or share a link? Later edit: I'm referring to your example in your link: salt = urandom(16) pepper = "oFMLjbFr2Bb3XR)aKKst@kBF}tHD9q" # or, getenv('PEPPER') hash…
passwordHash = bcrypt(salt + password)
encryptedHash = encrypt(passwordHash, pepper)
decryptedHash = decrypt(encryptedHash , oldpepper)
encryptedHash = encrypt(decryptedHash , newpepper)Earlier quoted context omitted.
Third party authentication should be the norm. Leaving authentication to providers that absolutely know their shit , just like we leave payments to third party services. Of course, that requires a decent protocol, and Mozilla is doing the world a disservice in not marketing Persona better seeing as it's the right solution....
You mean like how Authy specialised in two-factor authentication, but still managed to have basic string concatenation bugs that rendered their entire 2FA system bypassable?
Looks like they require Google Authenticator or Duo Mobile app to do two-factor auth. I'm not interested. Why can't they be like Github and just send me a text message? I don't want a dependency on some other company's product to make Slack more secure.